proxmox-create

#!/bin/sh
set -e
set -u

if test -e ~/.config/proxmox-sh/current.env; then
    # shellcheck disable=SC1090
    . ~/.config/proxmox-sh/current.env || true
fi

if test -z "${PROXMOX_HOST:-}" ||
    test -z "${PROXMOX_TOKEN_ID:-}" ||
    test -z "${PROXMOX_TOKEN_SECRET:-}" ||
    test -z "${PROXMOX_SEARCH_SUFFIX:-}" ||
    test -z "${PROXMOX_TARGET_NODE:-}" ||
    test -z "${PROXMOX_TARGET_VLAN:-}"; then

    {
        # shellcheck disable=2088
        echo "~/.config/proxmox-sh/current.env should contain values like these:"
        echo "(./.env.secret or ./.env may also be used) "
        echo ""
        echo "    # PVE Config"
        echo "    PROXMOX_HOST='pve1.example.net:8006'"
        echo "    PROXMOX_BRIDGE='vmbr0'"
        echo "    PROXMOX_SEARCH_SUFFIX='.localdomain'"
        echo "    PROXMOX_NAMESERVER='172.17.0.1'"
        echo ""
        echo "    # Deploy Config"
        echo "    PROXMOX_TARGET_NODE='pve1'"
        echo "    PROXMOX_TARGET_VLAN='1100'"
        echo ""
        echo "    # URL, File or String"
        echo "    PROXMOX_AUTHORIZED_KEYS='https://github.com/me.keys'"
        echo ""
        echo "    # Secrets"
        echo "    PROXMOX_TOKEN_ID='<user>@<strategy>!<token-name>'"
        echo "    PROXMOX_TOKEN_SECRET='00000000-0000-4000-8000-000000000000'"
        echo ""
    } >&2
    exit 1
fi

my_auth="Authorization: PVEAPIToken=${PROXMOX_TOKEN_ID}=${PROXMOX_TOKEN_SECRET}"
my_base_url="https://${PROXMOX_HOST}/api2/json"
my_curl="curl --max-time 15 --fail-with-body -sSL"

fn_discover() { (
    echo "${my_base_url}/"
    ${my_curl} -H "${my_auth}" \
        "${my_base_url}/" |
        jq '.'
); }

fn_status() { (
    echo "${my_base_url}/nodes/${PROXMOX_TARGET_NODE}/status"
    ${my_curl} -H "${my_auth}" \
        "${my_base_url}/nodes/${PROXMOX_TARGET_NODE}/status" |
        jq '.'
); }

fn_lxc_last_id() { (
    #echo "${my_base_url}/nodes/${PROXMOX_TARGET_NODE}/lxc"
    my_lxcs="$(
        ${my_curl} -H "${my_auth}" \
            "${my_base_url}/nodes/${PROXMOX_TARGET_NODE}/lxc"
    )"
    my_lxc_last_id="$(
        echo "${my_lxcs}" |
            jq -r '.data[].vmid' | sort | tail -n 1
    )"
    my_lxc_next_id="$((my_lxc_last_id + 1))"
    echo "${my_lxc_next_id}"
); }

fn_resources_next_index() { (
    my_prefix="${1}"
    my_zero="${2:-000}"

    # Or https://192.168.0.101:8006/api2/json/cluster/nextid ?
    #echo "${my_base_url}/cluster/resources"
    my_resources="$(
        ${my_curl} -H "${my_auth}" \
            "${my_base_url}/cluster/resources"
    )"

    my_resource_ids="$(
        echo "${my_resources}" |
            jq -r '.data[].vmid' |
            grep "^${my_prefix}"
    )"
    if test -z "${my_resource_ids}"; then
        my_resource_ids="${my_prefix}${my_zero}"
    fi
    my_resource_last_id="$(
        echo "${my_resource_ids}" |
            sort -u |
            tail -n 1
    )"

    # Goal: 1101001 => 2
    # 0. 1101001 => 1
    my_resource_index="$((my_resource_last_id % 1000))"
    # 1. 1 => 2
    my_resource_index="$((my_resource_index + 1))"

    echo "${my_resource_index}"
); }

fn_ssh_keys() { (
    my_key_uri="${1:-}"

    if test -z "${my_key_uri}"; then
        if ! command -v ssh-pubkey > /dev/null; then
            {
                echo ""
                echo "ERROR"
                echo "        'ssh-pubkey' does not exist and no ssh pubkey was given"
                echo ""
            } >&2

            return 1
        fi

        my_keys="$(
            ssh-pubkey 2> /dev/null
        )"
    fi

    my_keys="${my_key_uri}"
    case "${my_key_uri}" in
        http:*)
            echo "please use 'https://' for ssh public key urls"
            return 1
            ;;
        https:*)
            my_keys="$(
                ${my_curl} "${my_key_uri}"
            )"
            ;;
        *)
            if test -e "${my_key_uri}"; then
                my_keys="$(
                    cat "${my_key_uri}"
                )"
            fi
            ;;
    esac

    printf '%s' "${my_keys}" | grep -E '^(ssh|ecdsa)-[a-zA-Z0-9-]+ AAA' || true
); }

fn_create_lxc() { (
    # https://192.168.0.3:8006/api2/json/nodes/pve1/lxc

    my_target_node="${1}"
    my_vlan="${2}"
    my_num="${3}"
    my_hostname="${4}"
    my_pubkeys="${5}"

    my_os_tmpl="${6}"
    my_memory="${7}"
    my_mp0_size="${8}"
    my_cores="${9}"
    my_cpulimit="${10}"
    my_vmid="${11}"

    my_password="$(
        xxd -l12 -ps /dev/urandom |
            xxd -r -ps |
            base64 |
            tr -d = |
            tr + - |
            tr / _
    )"

    my_search_suffix="${PROXMOX_SEARCH_SUFFIX:-}"
    my_nameserver="${PROXMOX_NAMESERVER:-}"
    my_bridge="${PROXMOX_BRIDGE:-vmbr0}"
    #my_features='nesting=1'
    my_features="" # only non-default values can be set

    my_tmpl_vol=cephfs0
    my_fs_size=8
    my_fs_pool=pool0
    my_fs_opts=lazytime
    my_mp0_pool=pool0
    my_mp0_mnt='/mnt/storage'
    my_mp0_opts='lazytime;nodev;nosuid'
    my_net="$(
        fn_id_to_net "${my_vlan}" "${my_num}"
    )"

    # See POST at <https://pve.proxmox.com/pve-docs/api-viewer/#/nodes/{node}/lxc>
    my_task_result="$(
        ${my_curl} -H "${my_auth}" \
            -X POST "${my_base_url}/nodes/${my_target_node}/lxc" \
            --data-urlencode "start=1" \
            --data-urlencode "onboot=1" \
            --data-urlencode "vmid=${my_vmid}" \
            --data-urlencode "hostname=${my_hostname}" \
            --data-urlencode "arch=amd64" \
            --data-urlencode "unprivileged=1" \
            --data-urlencode "features=${my_features}" \
            --data-urlencode "password=${my_password}" \
            --data-urlencode "ssh-public-keys=${my_pubkeys}" \
            --data-urlencode "ostemplate=${my_tmpl_vol}:${my_os_tmpl}" \
            --data-urlencode "rootfs=${my_fs_pool}:${my_fs_size},mountoptions=${my_fs_opts}" \
            --data-urlencode "mp0=${my_mp0_pool}:${my_mp0_size},mp=${my_mp0_mnt},mountoptions=${my_mp0_opts}" \
            --data-urlencode "cores=${my_cores}" \
            --data-urlencode "cpulimit=${my_cpulimit}" \
            --data-urlencode "memory=${my_memory}" \
            --data-urlencode "swap=0" \
            --data-urlencode "net0=name=eth0,bridge=${my_bridge},tag=${my_vlan},${my_net},rate=91" \
            --data-urlencode "searchdomain=${my_vlan}${my_search_suffix}" \
            --data-urlencode "nameserver=${my_nameserver}"
    )"
    #{"success":1,"data":"UPID:pve1:000C38ED:01978844:640D7BB1:vzcreate:101:root@pam:"}

    my_task_id="$(
        echo "${my_task_result}" |
            jq -r '.data' |
            grep '^UPID:' || true
    )"

    if test "${my_task_id}" = "null"; then
        echo ""
        echo "${my_task_result}" |
            jq '.'
        echo ""
        echo "Error: Create failed"
        echo ""
        exit 1
    fi

    echo "${my_task_id}"
); }

fn_ha_groups_list() { (
    ${my_curl} -H "${my_auth}" \
        "${my_base_url}/cluster/ha/groups" | jq -r '.data[].group'
); }

fn_ha_resources_add() { (
    # See POST at <https://pve.proxmox.com/pve-docs/api-viewer/#/cluster/ha/resources>
    # https://192.168.0.3:8006/api2/json/cluster/ha/resources

    my_type="ct" # or vm
    my_sid="${1}"
    my_group="${2}"
    my_state="started"
    my_max_relocate="1"
    my_max_restart="1"
    my_comment=""

    ${my_curl} -H "${my_auth}" \
        -X POST "${my_base_url}/cluster/ha/resources" \
        --data-urlencode "type=${my_type}" \
        --data-urlencode "sid=${my_sid}" \
        --data-urlencode "group=${my_group}" \
        --data-urlencode "state=${my_state}" \
        --data-urlencode "max_relocate=${my_max_relocate}" \
        --data-urlencode "max_restart=${my_max_restart}" \
        --data-urlencode "comment=${my_comment}" |
        jq -r '.data'
); }

# Example
# vlan=1109, suffix=142
# mac = 00:52:11:09:01:42
# gw = 10.11.9.1
fn_id_to_net() { (
    # assumed to be always 4-digits (1101-1199)
    my_vlan="${1}"
    # assumed to be less than 4-digits (1-154)
    my_num="${2}"

    # 1101 => '11' '01'
    my_vlan_012="$(echo "${my_vlan}" | cut -c'1-2')"
    my_vlan_034="$(echo "${my_vlan}" | cut -c'3-4')"

    # 1101 => '11' '1'
    my_vlan_12="$((my_vlan_012 + 0))"
    my_vlan_34="$((my_vlan_034 + 0))"

    # 1 => 0001
    # 154 => 0154
    my_3digit="$((my_num + 1000))"
    my_3digit="$(echo "${my_3digit}" | cut -c'2-4')"
    my_4digit="0${my_3digit}"

    # 0001 => '00' '01'
    # 0154 => '01' '54'
    my_unit_12="$(echo "${my_4digit}" | cut -c'1-2')"
    my_unit_34="$(echo "${my_4digit}" | cut -c'3-4')"

    # 1 => 101
    # 154 => 254
    my_ip_suffix="$((my_num + 100))"

    printf "hwaddr=00:52:%s:%s:%s:%s," \
        "${my_vlan_012}" "${my_vlan_034}" "${my_unit_12}" "${my_unit_34}"
    printf "ip=10.%s.%s.%s/24," \
        "${my_vlan_12}" "${my_vlan_34}" "${my_ip_suffix}"
    printf "gw=10.%s.%s.1" \
        "${my_vlan_12}" "${my_vlan_34}"
); }

fn_wait_status() { (
    my_target_node="${1}"
    my_task_id_raw="${2}"
    my_check_count="${3:-1}"

    my_task_id="$(
        printf '%s' "${my_task_id_raw}" |
            xxd -plain |
            tr -d '\n' |
            sed 's/\(..\)/%\1/g'
    )"

    my_task_result="$(
        ${my_curl} -H "${my_auth}" \
            "${my_base_url}/nodes/${my_target_node}/tasks/${my_task_id}/status"
    )"

    my_task_status="$(
        printf '%s' "${my_task_result}" |
            jq -r '.data.status'
    )"
    echo "Status: ${my_task_status}"

    if test "${my_task_status}" = "running"; then
        if test "${my_check_count}" -ge 30; then
            echo "Error: tried 30 times"
            return 1
        fi

        sleep 1
        my_check_count="$((my_check_count + 1))"
        fn_wait_status "${my_target_node}" "${my_task_id_raw}" "${my_check_count}"
        return 0
    fi

    echo "${my_task_result}" | jq '.'
); }

# TODO
# https://192.168.0.3:8006/api2/json/pools
# https://192.168.0.3:8006/api2/json/nodes
# https://192.168.0.3:8006/api2/json/nodes/pve1/network?type=any_bridge

fn_help() { (
    my_pubkeys="${1:-}"

    echo ""
    echo "USAGE"
    echo "    proxmox-create <hostname> [ssh-pubkey-file-url-or-string]"
    echo ""
    echo "EXAMPLE"
    echo "    proxmox-create 'lxc-101-example' ~/.ssh/id_rsa.pub"
    echo ""
    echo "OPTIONS"
    echo "    --target-node 'pve1'  # pve1, pve2, pve3, or pve4"
    echo "    --os 'alpine18'       # alpine17,18,19,20 or ubuntu22,24"
    echo "    --vcpus 2             # 1-12 vCPU Cores"
    echo "    --duty-cycle 60       # 1-100 %"
    echo "    --ram 512             # 64-24576 MB"
    echo "    --storage 1           # 1-250 GB"
    echo ""

    if test -n "${my_pubkeys}"; then
        echo "DEFAULT SSH KEYS (only key comments are shown, for brevity)"
        printf '%s' "${my_pubkeys}" |
            cut -d' ' -f3 |
            sort -u |
            while read -r my_comment; do
                echo "    ${my_comment}"
            done
        echo ""
    fi
); }

fn_version() { (
    echo "proxmox-create v0.2024.08.12"
); }

fn_show_next() { (
    printf "Finding next available IP for vlan%s...\n" "${PROXMOX_TARGET_VLAN}"
    my_vlan_1="$(
        echo "${PROXMOX_TARGET_VLAN}" | cut -c-2
    )"
    my_vlan_1=$((my_vlan_1 + 0))

    my_vlan_2="$(
        echo "${PROXMOX_TARGET_VLAN}" | cut -c3-
    )"
    my_vlan_2=$((my_vlan_2 + 0))

    my_next_unit="$(
        fn_resources_next_index "${PROXMOX_TARGET_VLAN}"
    )"
    my_next_ip="$((my_next_unit + 100))"
    my_ip="10.${my_vlan_1}.${my_vlan_2}.${my_next_ip}"
    echo "    ${my_ip}"
    echo "    255.255.255.0 (/24)"

    my_next_id="${my_next_unit}"
    my_domain_suffix="${PROXMOX_SEARCH_SUFFIX:-.localdomain}"
    my_hostname="lxc-${my_next_id}"
    my_fqdn="${my_hostname}.${PROXMOX_TARGET_VLAN}${my_domain_suffix}"

    echo ""
    echo "    proxmox-create '${my_hostname}' ~/.ssh/id_rsa.pub"
    echo "    caddy-add '${my_ip}' '${my_fqdn}'"
    echo "    ssh -oProxyCommand='sclient --alpn ssh %h' '${my_fqdn}'"
    echo ""
); }

main() { (
    my_target_node="${PROXMOX_TARGET_NODE}"
    my_hostname=''
    my_pubkeys=''
    my_os='alpine'
    my_vcpus='2'
    my_ram='512'
    my_storage='0.1'
    my_duty_cycle='60'
    my_ha_group="prefer-${my_target_node}"

    case "${1:-}" in
        version | --version | -V)
            fn_version >&2
            return 0
            ;;
    esac

    {
        # shellcheck disable=SC2012
        ls -l ~/.config/proxmox-sh/current.env | sed 's;.* /;/;'

        echo "PROXMOX_HOST=${PROXMOX_HOST:-}"
        echo "PROXMOX_TARGET_NODE=${PROXMOX_TARGET_NODE:-}"
        echo "PROXMOX_TARGET_VLAN=${PROXMOX_TARGET_VLAN:-}"
        echo "PROXMOX_SEARCH_SUFFIX=${PROXMOX_SEARCH_SUFFIX:-}"
    } >&2

    while test -n "${1:-}"; do
        b_arg="${1:-}"
        shift

        case "${b_arg}" in
            help | --help)
                fn_help >&2
                return 0
                ;;
            --nesting)
                echo "ERROR --nesting is not supported yet" >&2
                return 1
                #my_features="nesting=1"
                ;;
            --target-node)
                my_target_node="${1:-}"
                my_ha_group="prefer-${my_target_node}"
                case "${my_target_node}" in
                    pve1 | pve2 | pve3 | pve4) ;;
                    *)
                        echo "ERROR: --target-node must be 'pve1', 'pve2', 'pve3', or 'pve4'" >&2
                        fn_help >&2
                        return 1
                        ;;
                esac
                shift
                ;;
            --os)
                my_os="${1:-}"
                case "${my_os}" in
                    ubuntu | ubuntu24 | ubuntu22 | ubuntu20) ;;
                    alpine | alpine20 | alpine19 | alpine18 | alpine17) ;;
                    *)
                        echo "ERROR: --os must be 'alpine' or 'ubuntu' (OS name)" >&2
                        fn_help >&2
                        return 1
                        ;;
                esac
                shift
                ;;
            --vcpus)
                my_vcpus="${1:-}"
                if test "${my_vcpus}" -lt 1 ||
                    test "${my_vcpus}" -gt 12; then
                    echo "ERROR: --vcpus must be between 1 and 12 (vCPUs)" >&2
                    fn_help >&2
                    return 1
                fi
                shift
                ;;
            --duty-cycle)
                my_duty_cycle="${1:-}"
                if test "${my_duty_cycle}" -lt 1 ||
                    test "${my_duty_cycle}" -gt 100; then
                    echo "ERROR: --duty-cycle must be between 1 and 100 (percent)" >&2
                    fn_help >&2
                    return 1
                fi
                shift
                ;;
            --ram)
                my_ram="${1:-}"
                if test "${my_ram}" -lt 32 ||
                    test "${my_ram}" -gt 24576; then
                    echo "ERROR: --ram must be between 32 and 24576 (megabytes)" >&2
                    fn_help >&2
                    return 1
                fi
                shift
                ;;
            --storage)
                my_storage="${1:-}"
                if test "${my_storage}" -lt 1 ||
                    test "${my_storage}" -gt 250; then
                    echo "ERROR: --storage must be between 1 and 250 (gigabytes)" >&2
                    fn_help >&2
                    return 1
                fi
                shift
                ;;
            --*)
                echo "ERROR: ${b_arg} is not a known flag" >&2
                fn_help >&2
                return 1
                ;;
            *)
                if test -z "${my_hostname}"; then
                    my_hostname="${b_arg}"
                    continue
                fi
                if test -z "${my_pubkeys}"; then
                    my_pubkeys="${b_arg}"
                    continue
                fi
                echo "ERROR: '${b_arg}' is not a known argument" >&2
                fn_help >&2
                return 1
                ;;
        esac
    done

    if test -z "${my_pubkeys}"; then
        my_pubkeys="${PROXMOX_AUTHORIZED_KEYS:-}"
    fi

    my_pubkeys="$(
        fn_ssh_keys "${my_pubkeys}"
    )"

    if test -z "${my_hostname:-}"; then
        {
            echo "ERROR: hostname argument is required"
            fn_help "${my_pubkeys}"
            fn_show_next
            echo "ERROR: hostname argument is required"
        } >&2
        return 1
    fi
    if echo "${my_hostname}" | grep -q -F '.'; then
        echo "'hostname' should be the short form: i.e. 'foo', not 'foo.example.com'"
        return 1
    fi

    printf "Finding next available id for VLAN %s... " "${PROXMOX_TARGET_VLAN}" >&2
    my_next_unit="$(
        fn_resources_next_index "${PROXMOX_TARGET_VLAN}"
    )"
    echo "${my_next_unit}" >&2

    my_net="$(
        fn_id_to_net "${PROXMOX_TARGET_VLAN}" "${my_next_unit}"
    )"
    my_ip="$(
        echo "${my_net}" |
            tr ',' '\n' |
            grep 'ip=' |
            cut -d'=' -f2 |
            cut -d'/' -f1
    )"

    if test -z "${my_os}"; then
        my_os='alpine'
    fi

    my_os_tmpl=''
    if test "alpine" = "${my_os}"; then
        my_os_tmpl='vztmpl/alpine-3.19-bnna_20240207_20241212_amd64.tar.zst'
    elif test "alpine20" = "${my_os}"; then
        my_os_tmpl='vztmpl/alpine-3.20-bnna_20240908_20241212_amd64.tar.zst'
    elif test "alpine19" = "${my_os}"; then
        my_os_tmpl='vztmpl/alpine-3.19-bnna_20240207_20241212_amd64.tar.zst'
    elif test "alpine18" = "${my_os}"; then
        my_os_tmpl='vztmpl/alpine-3.18-bnna_20230607_20241212_amd64.tar.zst'
        #my_os_tmpl='vztmpl/alpine-3.18-bnna_20230607_20240821_amd64.tar.xz'
    elif test "alpine17" = "${my_os}"; then
        my_os_tmpl='vztmpl/alpine-3.17-bnna_20221129_20241212_amd64.tar.zst'
        #my_os_tmpl=vztmpl/alpine-3.17-ssh+webi_20221129_amd64.tar.xz
    elif test "ubuntu" = "${my_os}"; then
        my_os_tmpl='vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst'
    elif test "ubuntu24" = "${my_os}"; then
        my_os_tmpl='vztmpl/ubuntu-24.04-standard_24.04-2_amd64.tar.zst'
    elif test "ubuntu22" = "${my_os}"; then
        my_os_tmpl='vztmpl/ubuntu-22.04-standard_22.04-1_amd64.tar.zst'
    elif test "ubuntu20" = "${my_os}"; then
        my_os_tmpl='vztmpl/ubuntu-20.04-standard_20.04-1_amd64.tar.gz'
    else
        echo "unknown OS template '${my_os}'"
        return 1
    fi

    # 1 => 1001
    my_3digit="$((my_next_unit + 1000))"
    # 1001 => 001
    my_3digit="$(echo "${my_3digit}" | cut -c'2-4')"
    my_vmid="${PROXMOX_TARGET_VLAN}${my_3digit}"

    {
        echo ""
        echo "    Host Node:     ${my_target_node}"
        echo "    ctid:          ${my_vmid}"
        echo "    HA Group:      ${my_ha_group}"
        echo ""
        echo "    OS:            ${my_os}"
        echo "    RAM:           ${my_ram}MB"
        echo "    /mnt/storage:  ${my_storage}GB"
        echo "    vCPU:          ${my_vcpus} cores"
        echo "                   ${my_duty_cycle}%"
        echo ""
    } >&2

    my_task_id="$(
        fn_create_lxc "${my_target_node}" "${PROXMOX_TARGET_VLAN}" "${my_next_unit}" "${my_hostname}" "${my_pubkeys}" "${my_os_tmpl}" "${my_ram}" "${my_storage}" "${my_vcpus}" "${my_duty_cycle}" "${my_vmid}"
    )"
    {
        echo "Waiting for ${my_task_id}..."
        fn_wait_status "${my_target_node}" "${my_task_id}"
        echo ""
        echo "Next steps: add your public domain(s)"
    } >&2

    printf "    caddy-add " >&2
    echo "${my_ip} ${my_hostname}.${PROXMOX_TARGET_VLAN}${PROXMOX_SEARCH_SUFFIX}"
    {
        echo "    caddy-add ${my_ip} CHANGE-ME.example.com"
        echo ""
    } >&2

    my_ha_groups="$(fn_ha_groups_list | grep '^prefer-')"
    if ! echo "${my_ha_groups}" | grep -q "^${my_ha_group}$"; then
        {
            printf "Warning: '%s' is not in the list of active HA Groups:\n\n%s\n\n" "${my_ha_group}" "${my_ha_groups}"
            echo "Please update manually"
        } >&2
        return 1
    fi
    if fn_ha_resources_add "${my_vmid}" "${my_ha_group}" > /dev/null; then
        echo >&2 "(also added '${my_vmid}' to HA Group '${my_ha_group}'"
    else
        echo >&2 "WARN: did not add '${my_vmid}' to HA Group '${my_ha_group}'"
    fi
); }

main "${@:-}"